DDoS Two-Layer Architecture

Hi ukhan20 , 

What is the problem to achieve that. 

One Arm deployment isn't a limitation for that 
you can configure L3/L4 as well as L7 DDoS protection , just you need provision AFM and choose security Turboflex profile then provision ASM or AWAF License. 
Then you can configure whatever you need. 

Even you can configure AFM DoS protection in ( Device and Protected objects level ) and use AWAF l7 DoS as well. 

Could you clarify what challenging you in this deployment.

maybe this will not be a two-tire deployment as you will have AFM DOS and AWAF DoS on the same BIGIP, I mean you will do all in the same tire or layer. 

if you want to achieve the multi-tire deployments 
you have to use two devices, one for AFM and the other one for AWAF close to DMZ or application servers. 

I'm new to this, so I appreciate your patience.

Client traffic first passes through VM1 (AFM for L3/L4) on the VCMP-enabled VMs, then to VM2 (WAF for L7), and finally reaches the server. This process is achieved through a one-arm configuration, as shown in the screenshot. ( how to achive this , i am aware to AFM at L3 and L4)

If there's no need for inspection by VM2 (WAF), the traffic goes directly from VM1 (L3/L4) to the server.

Could you please confirm if this setup is correct?

Hi ukhan20

Different approach...

Let me summary what one-arm mode is 

In a one-arm deployment, all traffic flows through the BIG-IP system using a single network interface. The system inspects and processes the traffic but does not perform full routing.

• Ingress and Egress Traffic: Both incoming and outgoing traffic use the same interface.
• This simplifies the setup for PoC purposes and allows easy testing of DDoS mitigation at multiple layers (L3/L4 and L7).

Enable and Configure vCMP

Since your VIPRION 4450 supports vCMP (virtualized BIG-IP instances):

1. Create two guest instances:
   • One for AFM (L3/L4 DDoS protection).
   • One for AWAF (L7 WAF protection).
2. Assign appropriate resource allocations (CPU, memory, and bandwidth) to each guest.
3. Configure VLANs or interfaces for traffic flow within the virtual guests.

Deploy L3/L4 DDoS Protection with AFM

Configure AFM (Advanced Firewall Manager) to mitigate DDoS attacks at the network tier (L3/L4):

Steps:

1. Navigate to Security >> DoS Protection >> Network Protection.
2. Enable DoS Protection on the Virtual Server handling traffic for the network tier.
3. Create and apply DoS Profiles:
   • Enable protections like SYN Flood, UDP Flood, ICMP Flood, and DNS Amplification.
   • Set rate limits and thresholds to mitigate volumetric attacks.
4. Configure IP Intelligence to detect and block malicious IPs automatically.

Key Notes:

• Attach a DoS Profile to the wildcard or relevant Virtual Server.
• Use Threshold Settings for traffic baselining.

So, to test...

• Simulate different DDoS attack vectors:
  • Network Layer (L3/L4): Use tools like hping3, LOIC, or similar for SYN floods, UDP floods, etc.
  • Application Layer (L7): Use tools like slowloris, apache benchmark, or HTTP GET/POST floods.
• Monitor traffic behavior using Dashboards:
  • AFM → Security >> DoS Protection >> DoS Dashboard.
  • AWAF → Security >> Application Security >> Charts and Reports.
• Verify:
  • Traffic at the network tier is mitigated by AFM.
  • Legitimate traffic continues to flow through AWAF for L7 protection.

If you need anything, do not hesitate to come to here.

Harun

is your company a network service provider?
if it isnt, volumetric dos will make your wan links full well before viprion vserver is overwhelmed.
and ltm/asm http/s vserver by default acts as L4-7 filter that only forwards healthy client requests (not simply connection) to backend servers.